Thanks. I have tested your version of the rule, and it works *so long as* there aren't GET parameters in the requested URI.
For example, the following request triggers an alert: 1.2.3.4 - -[25/Feb/2016:08:43:08 -0700] "GET /icons/whatever/requeststringtest.php HTTP/1.1" 20068393 blahblahblah However, this request is ignored: 1.2.3.4 - -[25/Feb/2016:08:43:08 -0700] "GET /icons/whatever/?C=http://5.6.7.8/requeststringtest.php HTTP/1.1" 20068393 blahblahblah Any ideas why that is? -- --- You received this message because you are subscribed to the Google Groups "ossec-list" group. To unsubscribe from this group and stop receiving emails from it, send an email to ossec-list+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
